CVE-2025-34035

EnGenius EnShare Cloud Service version 1.4.11 and earlier is vulnerable to an OS command injection vulnerability. The usbinteract.cgi script fails to properly sanitize user input provided to the path parameter, allowing unauthenticated remote attackers to inject and execute arbitrary shell comman...

CVE-2025-34035 EnGenius EnShare IoT Gigabit Cloud Service Command Injection

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected...

CVE-2025-34035 EnGenius EnShare IoT Gigabit Cloud Service Command Injection

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected...

EnGenius EnShare Cloud Service 操作系统命令注入漏洞

EnGenius EnShare Cloud Service is a cloud-based network management platform from EnGenius Corporation. An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier, which stems from an OS command injection attack due to an uncleared path parameter in t...

PT-2025-26662

Name of the Vulnerable Software and Affected Versions: EnGenius EnShare Cloud Service versions 1.4.11 and earlier Description: An OS command injection issue exists due to the usbinteract.cgi script's failure to properly sanitize user input passed to the path parameter. This allows unauthenticated...

CVE-2025-34035: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected...

VulnCheck KEV: CVE-2025-34035

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected...

Yealink YMCS 安全漏洞

Yealink YMCS is a cloud management service from China Yealink Yealink used to centrally manage and maintain Yealink's devices. A security vulnerability exists in Yealink YMCS versions prior to 2025-05-26, which stems from not blocking access to OpenAPI for frozen enterprise accounts, which could...

Yealink YMCS RPS 安全漏洞

Yealink YMCS RPS is a device management cloud service platform with integrated RPS functionality from China Yealink Yealink. A security vulnerability exists in Yealink YMCS RPS versions prior to 2025-06-04, which stems from a lack of SN authentication attempt limitations that could lead to brute...

Yealink YMCS RPS 信任管理问题漏洞

Yealink YMCS RPS is a device management cloud service platform with integrated RPS functionality from China Yealink Yealink. A trust management issue vulnerability exists in Yealink YMCS RPS versions prior to 2025-05-26, which stems from the certificate upload function not properly validating the...

CVE-2025-22874 vulnerabilities

Vulnerabilities for packages: capslock, licenseclassifier, sftpgo-plugin-geoipfilter, wuzz, aws-privateca-issuer, traefik, aws-eks-pod-identity-agent, helm-push, flux-kustomize-controller, dataplaneapi, knative-client, k9s, direnv, kubernetes-dns-node-cache, aws-application-networking-k8s,...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.14.18 Bug Fix Update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.14.18 on Red Hat Enterprise Linux 9 from Red Hat Container Registry. Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation...

The vulnerability of the CloudSrvUserdataVersionCheck() function in TOTOLINK CA600-PoE router’s software allows a hacker to execute arbitrary commands.

The vulnerability of the CloudSrvUserdataVersionCheck function in TOTOLINK CA600-PoE router’s software lies in the lack of measures taken at the control level during the processing of the Version parameter. Exploiting this vulnerability allows an attacker to execute arbitrary commands by sending...

CVE-2023-26316

A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking function allowing javascript protocol to be loaded and can be exploited by attackers to steal Xiaomi cloud service account's cookies...

CVE-2018-7580

Philips Hue is vulnerable to a Denial of Service attack. Sending a SYN flood on port tcp/80 will freeze Philips Hue's hub and it will stop responding. The "hub" will stop operating and be frozen until the flood stops. During the flood, the user won't be able to turn on/off the lights, and all of...

CVE-2019-0322

SAP Commerce Cloud previously known as SAP Hybris Commerce, HYCOM, versions 6.3, 6.4, 6.5, 6.6, 6.7, 1808, 1811, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...

CVE-2025-44841

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

ASUS AiCloud Improper Authentication Control Vulnerability

AiCloud is a cloud service from ASUS, designed to provide easy access to the data inside the router's back-up devices such as USBs or PCs, as well as uploading, downloading, playing music online, browsing documents online, sharing links to Facebook, and setting up Smart Sync to synchronize with t...

ASUS AiCloud 安全漏洞

AiCloud is a cloud service from ASUS, designed to provide easy access to the data inside the router's back-up devices such as USBs or PCs, as well as uploading, downloading, playing music online, browsing documents online, sharing links to Facebook, and setting up Smart Sync to synchronize with t...

PT-2025-18652 · Totolink · Totolink Cpe Cp900

Name of the Vulnerable Software and Affected Versions: TOTOLINK CPE CP900 version 6.3c.1144 B20190715 Description: A command injection issue was found in the CloudSrvUserdataVersionCheck function, allowing attackers to execute arbitrary commands via a crafted request. This is possible through the...